AI in a nice wrapper: what the demo doesn't show

Jens Leroy, AI Business Partner at Xylos, walked past the demos at a trade fair and lists the questions to ask before you click "allow".

It is mid-afternoon at a trade fair. I have been standing at the same booth for ten minutes, in a small crowd of mostly business owners who, like me, are curious to see what we are about to be shown. On the screen, an AI agent reads an inbox of two hundred emails, puts the leads in the CRM, writes three quotes and schedules the follow-up calls. The salesperson smiles: "Five minutes to install. You connect your mailbox, your CRM, and you're done." The enthusiasm is high, the questions stay on the surface. I move on to the next stop. Two booths further, nobody is there. On the screen, someone gets a phone call from an AI avatar that runs through his day with him.

Honestly? It gets me excited too. As an AI Business Partner at Xylos, it is my job to see what is already possible today. But while the demo runs, a different list opens up in my head. What rights does that thing get on that mailbox? Where do those two hundred emails and that calendar full of customer information end up? And can I make it do something it was never meant to do?

That list is never part of the demo. Hence this blog. I am certainly not trying to talk you out of AI, quite the opposite. I do want to show what sits under that nice wrapper and how you can get started safely and still quickly.

A demo shows what a tool can do, but rarely everything you hand over to it.

During that five-minute installation, you click "allow" a few times. Access to your mailbox, your calendar, your CRM, perhaps your shared drive. It goes so smoothly that you hardly stop to think about it. Yet you wouldn't give a new intern the keys to the whole building and the safe on their first day either.

What's more, those keys don't only go to the tool. They also go to the company behind it and to the parties that company builds on in turn. And in a sense to anyone who can get the tool to read something: an agent that processes your mailbox also reads emails from outsiders, and they don't always have the best intentions. If a cleverly worded instruction is hidden in there, the agent may simply carry it out. That is called prompt injection.

You could see how that plays out in practice at McDonald's last year. The chain has job applicants screened by Olivia, a chatbot from an external vendor. Convenient, scalable and no doubt a great demo. In 2025, two security researchers tried to log in to that vendor's admin portal. On their second attempt they got in, with "123456" as both username and password. Behind it were up to 64 million job application records.

The leak was fixed quickly, and according to the vendor nobody else had looked in. But it was McDonald's name that made the papers, while the vendor stayed in the background. You can outsource a task to a tool, but not the responsibility.

Ask these three questions for every new AI tool first:

1. What does the tool really need for this one task? A summary of your emails does not require the right to send emails.

2. Where does my data go, and who else can access it? Does it stay in your own environment, or does it end up with the vendor and its partners?

3. What can the tool do without asking me? Anything you cannot undo, you want to see yourself first.

If you don't get a clear answer, that is an answer too.

Does that mean you are better off ignoring those demos? Not at all. I enjoy watching them myself. But I do watch with sunglasses on, so I don't get blinded by whatever is shining on the screen.

As an AI Business Partner, I first map out exactly where you would use such a tool, or better still a complete application. That is about the structure: where is your data today, who can already access it and which systems talk to each other? About the process: which task does the AI take over exactly, and where does a human need to decide? And about the people: who will work with it, what do they know about the risks and what do they do when the official tool doesn't do what they need? And finally: how does this fit into your broader strategy and architecture?

Only once that is clear do we look at the tool. Often we then build an application ourselves within the environment you already manage. Your data does not move, the permissions you have set up today stay in force, and every agent only gets access to what it needs for its task. Sometimes an existing tool fits perfectly. That's fine too, but at least you know what you are bringing in.

That salesperson was right, by the way: a tool like that is installed in five minutes. The only question is who else can get in after those five minutes.

Do you want to know which AI tools are already in use in your organisation today and what they are allowed to do? Or did you see a demo yourself that you can't stop thinking about? Then let's look together, with sunglasses on, at how you can use AI safely in your processes.

Want to check for yourself first how AI-ready your organisation is? Take the AI Readiness Scan.

Book a conversation with our AI team